CVE-2022-24248

 

Published at: - 12-04-2022 02:15

Last modified: - 20-04-2022 07:01

Total changes: - 2

Description

RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

 

Verification logic

 

Reference

• https://www.exploit-db.com/exploits/50615
• https://en.0day.today/exploit/description/37177

 

Keywords

NVD

 

CVE-2022-24248

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures